CVE-2026-19224

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

Malicious code in cors-update (npm)

Source: amazon-inspector 59c243bfa0251c11e10ceee74a90cffa2189086cf647ad8dfe6d70ab5e3491a5 Package impersonates the widely-used cors Express middleware. lib/index.js copies the legitimate expressjs/cors source but adds an exported getPlugin factory that issues an HTTPS GET to a hardcoded URL...

Malicious code in commerce-utils (npm)

Malicious package due to data exfiltration to a suspicious host, combined with arbitrary code execution during preinstall. Source: amazon-inspector 3bb3d6d3a8a8898abe7e371e54753d5902a5062151888ccff6c656f5edac6ba6 The package commerce-utils was found to contain malicious code. --- Credit: OpenSSF...

Malicious code in cobrowsing-configs (npm)

Source: amazon-inspector 45bae002aa55664445a0af3da60cf5187e91f09e77eee63b2da3d4840b30d558 On require of cobrowsing-configs, index.js loads polyfill.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints oob-worker.cf99-9b3.workers.dev,...

Malicious code in cnb-cnb-core (npm)

Source: amazon-inspector 6d98cce19255e9c794f6211b2af4feb078a17256448ef693fbdb31cb1de27b97 On require'cnb-cnb-core', index.js loads shim.js which downloads a platform-specific executable from string-obfuscated hosts oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev,...

Malicious code in clients-structure (npm)

Source: amazon-inspector 5dc3674a31787baaf2d3d554336f507ecce91da7b4d527a170c50cd720024d48 On require of clients-structure, index.js loads ext.js which selects a platform-specific endpoint, fetches a binary from a rotating list of anonymous Cloudflare Workers subdomains...

Malicious code in claims-get-percentage-value (npm)

Source: amazon-inspector fcb53d2b24eba1d763f7d76c41b006cc7a6d236677fcc2749b310cb3389ab161 The package's main entry index.js unconditionally requires platform.js, which on module load fetches a platform-specific executable from hardcoded string-concatenated hosts oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-mobile-dolyame (npm)

Source: amazon-inspector 5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd Requiring checkout-mobile-dolyame loads loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated Cloudflare workers.dev mirrors...

Malicious code in checkout-types (npm)

Source: amazon-inspector 5d17ce247f3e7fa94b43e93af7597a9ae8a2a4008048a1ae8deb9352f45fc731 On require of checkout-types, index.js loads vendor.js which runs setup at top level. The code reconstructs C2 hostnames from split string arrays oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-todo-test (npm)

Source: amazon-inspector a87cb6c1e9ab39c21cd5d1031cadd2c192f86aaa337a62a7476657d5ee3f7f39 On require of this package, index.js loads platform.js, which asynchronously downloads a platform-specific binary from anonymous Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in checkout-parameters (npm)

Source: amazon-inspector cc0cff223506622cf77c0c0c038390701fbc4dfa3bb8a1be146263a9eede7774 On require'checkout-parameters', index.js loads vendor.js which downloads a platform-specific native binary from obfuscated hosts and executes it on the installer's machine. Destination hostnames are...

Malicious code in checkout-desktop-promocode (npm)

Source: amazon-inspector 19310e46ffcb5a99a81bab29f7260407b9fb6af5af72bdd8f3b9f7819cc6ffda On require of checkout-desktop-promocode, index.js loads vendor.js which selects a per-platform endpoint, downloads a binary over HTTPS from obfuscated author-controlled hosts sdk.dl.wel1.ru, ext.dl.wel1.ru,...

Malicious code in chai-assertions-plus (npm)

Source: amazon-inspector 80a83cd9353779d12538e8c6b06276178f6f0c246abd7d5148ce805536cbf57f The package is published as a Chai assertions extension, but the shipped code in index.js and lib/ is unrelated Pino logger source used as filler. Requiring the package loads lib/initializeCaller.js, which...

Malicious code in chai-as-rendered (npm)

Source: amazon-inspector 545ba2341881e666831e81156a815fdfac738830ec2918167e4c5fd3c42294bf Typosquat of chai-as-promised. The package's exported middleware spawns a detached child process lib/caller.js that fetches a JSON payload from a base64-obfuscated jsonstorage.net URL...

Malicious code in certificates-revocation-utils (npm)

Source: amazon-inspector 4f10384b425fd13237d69f5a9d71f6c893bd9063b32be2665f8a30f95ddda837 On module load, index.js requires vendor.js which fetches a platform-specific binary from runtime-reconstructed Cloudflare Workers hostnames assembled via split-string concatenation such as...

Malicious code in cbp-exchange-government-cbp-exchange-government-core (npm)

Source: amazon-inspector 4e8845f778d906df5e69c06c91840deb7718a94ccacdd371c987b003f6d85bdb index.js unconditionally requires./loader on module load. loader.js assembles three Cloudflare Workers hostnames via split-array .join"" obfuscation oob-worker.cf100-416.workers.dev,...

Malicious code in tailwindcss-3d-styles (npm)

Source: amazon-inspector 6afb2de10208993a1e7511cb81a6f11806561b389673da3fa24d22598178b744 The package's main entry point fetches a JavaScript file from http://23.27.245.100:3000/index.js over plain HTTP at require time, writes the response to./inout.js in the current working directory, and requir...

Malicious code in tailwind-scrollbar-styles (npm)

Source: amazon-inspector 2c9c5760f878552d4d2aedb3afc283b64ba99e65acf1e086158afe79a0267ada dist/index.js exports a small tailwind plugin and then runs evalatob"Z2x..." on an embedded base64 blob at module load time. The decoded loader queries Ethereum RPC endpoints 1rpc.io/eth, drpc.org, publicnod...

Malicious code in text-transform-plus (npm)

Source: amazon-inspector e3efed1eeb185e17a51a67059e57156e5c540899e5a30076df710e0242a5560c The package's postinstall script downloads a ZIP archive from a hardcoded Dropbox URL https://www.dropbox.com/scl/fi/djz38wdi1wks9j1h57zuv/coeur.zip to a hidden randomized temp path, extracts it using...

Malicious code in tailwind-aspect (npm)

Source: amazon-inspector e6ba6037f5f2f65c0ceef0ba5bd8da931b7860a85e7a38fb2703ad4cd7672ddf The package's main entrypoint unconditionally downloads a JavaScript file from the hardcoded plain-HTTP bare-IP URL http://23.27.245.100/index.js, writes it to./inout.js, and requires it every time a consume...